archive:computers:trojan.pro
Mark Garvin -- Xymetric Productions -- New York City 3-7-87
I guess I have stirred some interest with my recent messages to BBS's concerning Trojan horse programs. I have decided to write the following file in the interest of warning others and hopefully finding clues to the origin of the programs.
I have been operating a Priam 60 Meg hard disk on my AT for the past two years with good results. About four months ago, I encountered a Trojan horse program called HI-Q.COM which corrupted the FAT table on the disk. I lost access to the entire D: drive and the files and boot sectors on the C: drive were so badly damaged that I had to reformat the drive. Since there was nothing to be lost by trying the program again, I decided to confirm that HI-Q.COM was indeed the culprit. I ran a couple of the popular Trojan finders on the file first: Nothing. Thinking perhaps I was mistaken, I ran HI-Q under an INT13-trapper. No INT 13's were found and HI-Q ran normally. Upon rebooting the system, I found the same boot- sector errors, and CHKDSK again reported numerous cross-links, etc. I reformatted the drive and ran media checks to make sure the Priam was sound. After checking several other programs (I did NOT run the Trojan- testers or INT13-trapper again in case those were perhaps Trojan), I ran HI-Q.COM for the third time. Same results. This is enough for me: I'm convinced.
Up until this point, I had heard of Trojan horses, but honestly doubted that there were actually competant computer programmers around who were wierd enough to write such a thing. I should also note that there is a program called HI-Q.EXE which has been tested by some boards, and is supposedly NOT a Trojan. I'm not going to try it on my hard disk system. The HI-Q.COM program may not have even been an intentional Trojan -- I'm willing to keep an open mind on the subject. Maybe it was incompetent programming, or perhaps someone ran SPACEMAKER or a similar program on the .EXE file to convert it to a .COM file, and inadvertantly created a Trojan.
OK -- that's one thing.. The next Trojan I ran was DEFINITELY intentional. I had reformatted my Priam after the previous incident, and I haven't allowed the mysterious HI-Q program back on the system. However, I HAVE run numerous file-managers, etc. from local BBS's -- maybe I'm just a trusting individual, but I wasn't ready to give up on Public Domain or shareware software just yet. Recently, the Priam starting giving me trouble again: crosslinked and lost files, and no boot. I called Priam, hoping to get instructions for perhaps salvaging files on the D: drive, since the partition was destroyed. Priam's tech guided me through a HEX/ ASCII dump of the boot record via a trap-door in Priam's FDISK program. Needless to say, we were BOTH incredulous at the result. Dis-believers should look closely at the HEX/ASCII dump below. This was NOT retyped or altered in any way. After booting from floppy, I redirected printer output to a disk file. What you are looking at below is exactly what appeared on my screen after the crash.
0 = Master Boot Record, 25 = Extended Volume Record 1 - 24 = Volume Boot Record
Enter number of record to display (0 - 25) : [ 0]
D H 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF 0/ 0 EB 7D 53 4F 46 54 4C 6F 4B 2B 20 33 2E 30 0D 0A ..SOFTLoK+ 3.0..
16/ 10 11 28 43 29 20 53 4F 46 54 47 55 41 52 44 0D 0A .(C) SOFTGUARD.. 32/ 20 53 59 53 54 45 4D 53 2C 20 49 4E 43 2E 20 0D 0A SYSTEMS, INC. .. 48/ 30 32 38 34 30 20 53 74 20 54 68 6F 6D 61 73 0D 0A 2840 St Thomas.. 64/ 40 45 78 70 77 79 2C 20 73 74 65 20 32 30 31 0D 0A Expwy, ste 201.. 80/ 50 53 61 6E 74 61 20 43 6C 61 72 61 2C 20 20 0D 0A Santa Clara, .. 96/ 60 43 41 20 39 35 30 35 31 20 20 20 20 20 20 0D 0A CA 95051 .. 112/ 70 34 30 38 2D 39 37 30 2D 39 34 32 30 10 07 00 FA 408-970-9420…. 128/ 80 8C C8 8E D0 BC 00 7C FB 8B F4 8E C0 8E D8 FC BF ……|……… 144/ 90 00 06 B9 00 01 F3 A5 EA D4 06 00 00 45 72 72 6F …………Erro 160/ A0 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 r loading operat 176/ B0 69 6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 ing system.Missi 192/ C0 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 ng operating sys 208/ D0 74 65 6D 00 BE BE 07 B9 04 00 AC 3C 80 74 15 83 tem……..<.t.. 224/ E0 C6 0F E2 F6 CD 18 AC 0A C0 74 FE BB 07 00 B4 0E ………t…… 240/ F0 CD 10 EB F2 4E 8B 14 8B 4C 02 BB 00 7C B8 11 02 ….N…L…|…
Press <Esc> to ABORT, any other key to continue .
0 = Master Boot Record, 25 = Extended Volume Record 1 - 24 = Volume Boot Record
_
In the interest of justice, I would like to make the following obser- vations:
1) The MAIN phone no. for SoftGuard systems is: 408-970-9240, NOT 9420.
The no. listed above is not in use. The message it gives IS the
normal message for that area, even though it sounds like it is com-
puter generated. The phone co. says it is actually registered to
Siliconix, a Silicon Valley chip-manufacturer, who probably has no
interest in Public Domain software or BBS's.
2) I called SoftGuard, and they gave me a Mr. Phelps-type message, disavow-
ing any knowledge of any Trojan programs or of SOFTLok, etc. which they
said is not an official product. However, they have not returned my
calls requesting additional information, and a request to speak to some-
one knowledgable about their software protection techniques has not been
answered. This may mean either that the message was cooked up by some-
one with a vendetta against SoftGuard (I don't know why!), or that Soft-
Guard wants to be able to identify the source of the Trojan program by
the information phoned in by irate people whose disks have just crashed.
In my opinion, the juxtaposition of the phone no. digits could be caused
by errors on the part of whoever wrote the Trojan program, whether it
was within SoftGuard, or not. After restoring the hard disk, I scanned
every file on it, and "SoftGuard" did not appear anywhere. The clever-
ness in bit-shifting the ASCII digits, or otherwise disguising them, may
also have resulted in the wrong phone no.
3) I have not, and will not, install SoftGuard programs on my disks. Also,
I obviously do not have any reason to run any of the unprotect programs
for SoftGuard, of which some are supposedly Trojans themselves (see
below). I have no idea of which file of the 2,000+ files on my system
was the origin of the message. As explained above, I have scanned them
for ASCII text and I've come up with nothing so far.
There are numerous warnings in circulation concerning SoftGuard Systems, manufacturers of the SuperLock copy-protection scheme. They SUPPOSEDLY upload Trojan programs to BBS's either to try to get their own form of justice against those who try to crack their software, or because they are just bitter about the numerous SoftGuard/SuperLock unprotectors which are circulating on the BBS's. Most of these Trojans have the name SUG.. (Soft-Un-Guard) or something similar. I did not originally believe that SoftGuard would be stupid enough to do such a thing. After all, a lesson should have been learned by the example of Prolok (another copy-protect manufacturer), who claimed that their new software would destroy the hard disk of anyone who tried to mis-use it. Most users, legitimate and other- wise, dropped them instantly, even though Prolok realized their grave error and retracted their previous advertising. After all, who wants to have their hard disk destroyed by accidently inserting the wrong key disk?
The SUG programs mentioned are reported to say something like: "Courtesy of SoftGuard Systems .. So sue us!" -- after trashing the hard disk.
My feelings about possibly casting doubt on the integrity of SoftGuard ? They did NOT convince me that they were blameless, and if they cared, they would have returned my phone calls. However, it MAY just be coincidence that a lot of the Trojan programs mention SoftGuard.
Recommendations:
Whether SoftGuard is at fault or not, they did not give me an adequate explanation of the rumors circulating about them, and they did not return my calls. I would recommend that individuals and companies stay away from SoftGuard/SuperLock, or any other copy-protect program which writes hidden, strange information onto their hard disks. Users of such copy-protected software should write or call the manufacturers and re- quest that the copy protection be discontinued. Explain to them that pirates will always crack copy-protection, and that only the legitimate users suffer from its use. If you work for a company that uses copy- protected software, why not get a print-out of this file and show it to the person in charge of purchasing software?
If you DO have a hard disk crash, try to recover the boot-record on the disk before just giving up and reformatting. You may find something similar to the above. The manufacturer or vendor of your hard disk may be able to steer you through the proper procedure for doing this.
Read this month's (March 1987) issue of 'Computer Language' for more information on Trojan horse programs. The article recommends contacting Eric Newhouse at THE CREST BBS regarding trojan horse programs. If you DO run into one, keep a copy of the file, and have a knowledgable BBS- user send it, and an explanation to Eric's BBS at 213-471-2518. DO NOT SEND THE FILE WITH ITS ORIGINAL NAME. The file name should be changed to something NOT ending in .EXE or .COM (how about .TRJ), and it should be sent to the attention of the SYSOP. This is usually done by waiting for the prompt to enter the file description, and starting the descrip- tion with '/'. Afterwards, also leave a comment to SYSOP which states the nature, and description of the file. In other words, don't inadver- tantly upload a Trojan program which could victimize others.
Watch out for some of the so-called Trojan testers. The majority of these are legitimate, but a few of them are actually Trojans themselves. Also, before jumping the gun and assuming a program is Trojan, check other possible sources for disk errors, etc. Sometimes hard disk media just develops errors, and there ARE some programs circulating as 'jokes' which put a message up which says they are reformatting your drives, or even claim to be draining excess water out of your disk drives. Most of the nasty Trojan programs don't cause their damage immediately. They wait for the drive to fill up a bit, or they wait for a random time interval. In the latter case described above, I suspected a file manager that I had just run. It turns out that others have used the program with no ill effects.
It seems to me that the future of PD software, as well as BBS systems is being threatened by this type of thing. A concerted effort on the part of SYSOPS to correlate the names and origins of people who upload Trojan software may help to track them down. Most BBS software keeps track of the names of people uploading software. I doubt that Trojan writers are stupid enough to list their real names, but it's time that some ingenuity was used in putting a stop to this.
I am a serious software developer, and I have taken some time off to write this message in the interest of helping other PD software users. Unfortunately, I don't have the time to coordinate any effort in analysis of Trojan programs and I cannot be contacted by phone (unlisted), but if you DO run into something similar, or if you have questions about any of the info presented here, leave me a personal message on any of the larger BBS's in New York City, and I will try to reply on the same board.
PLEASE DO circulate this file. It is important information for anyone running a BBS, or using Public Domain or SoftGuard/SuperLock software.
cturer), who claimed that their new software would destroy the hard
disk of anyone who tried to mis-use it. Most users, legitimate and other- wise, dropped them instantly, even though Prolok realized their grave error and retracted their previ
/home/gen.uk/domains/wiki.gen.uk/public_html/data/pages/archive/computers/trojan.pro.txt · Last modified: 1999/08/01 17:51 by 127.0.0.1